Mercurial > dnsbl
annotate dnsbl.conf @ 340:be776a246f97
when dkim require_signed overrides envelope from whitelisting, we still want to check dns based white/blacklists before content filtering
| author | Carl Byington <carl@five-ten-sg.com> |
|---|---|
| date | Wed, 21 Dec 2016 15:08:28 -0800 |
| parents | a4f2fda72422 |
| children | f4ca91f49cb6 |
| rev | line source |
|---|---|
| 127 | 1 context main-default { |
| 2 // outbound dnsbl filtering to catch our own customers that end up on the sbl | |
| 3 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 174 | 4 dnsbl_list sbl; |
| 127 | 5 |
| 6 // outbound content filtering to prevent our own customers from sending spam | |
| 7 content on { | |
| 8 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
9 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s"; |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
10 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
11 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s"; |
| 127 | 12 ignore { include "hosts-ignore.conf"; }; |
| 13 tld { include "tld.conf"; }; | |
| 14 html_tags { include "html-tags.conf"; }; | |
| 15 html_limit on 20 "Mail containing excessive bad html tags rejected"; | |
| 16 html_limit off; | |
| 17 host_limit on 20 "Mail containing excessive host names rejected"; | |
| 18 host_limit soft 20; | |
| 178 | 19 spamassassin 4; |
| 20 require_match yes; | |
| 21 dcc_greylist yes; | |
| 22 dcc_bulk_threshold 50; | |
| 127 | 23 }; |
| 24 | |
|
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
25 // backscatter prevention - do not send bounces for mail that we accepted but could not forward |
| 127 | 26 // we only send bounces to our own customers |
| 27 env_from unknown { | |
| 28 "<>" black; | |
| 29 }; | |
| 136 | 30 |
|
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
31 // hourly recipient rate limit by smtp auth client id, or unauthenticated mail from address |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
32 // hourly unique ip addresses by smtp auth client id, or unauthenticated mail from address |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
33 // default hourly rate limit is 30 |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
34 // daily rate limits are 4 times the hourly limit |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
35 // default hourly unique ip addresses is 5 |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
36 // daily unique ip addresses are 4 times the hourly limit |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
37 rate_limit 30 4 5 4 { // default |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
38 fred 100 10; // override default limits |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
39 joe 10 2; // "" |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
40 "sam@somedomain.tld" 500 2; |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
41 "@otherdomain.tld" 100 2; |
| 136 | 42 }; |
| 127 | 43 }; |
| 44 | |
| 94 | 45 context main { |
| 136 | 46 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 94 | 47 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 174 | 48 dnsbl sbl zen.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
| 94 | 49 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
| 249 | 50 dnswl dnswl.org list.dnswl.org 2; |
| 171 | 51 dnsbl_list local sbl; |
| 249 | 52 dnswl_list dnswl.org; |
|
268
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
53 require_rdns yes; |
| 94 | 54 |
| 55 content on { | |
|
322
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
56 dkim_signer { |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
57 // we could add consumer facing domains like yahoo.com, aol.com, etc |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
58 // here, IF you really want to accept all the mail from such folks. |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
59 five-ten-sg.com white; |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
60 some.spammer black; // reject if signed by them |
|
322
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
61 }; |
|
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
62 |
|
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
63 dkim_from { |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
64 // cannot really add consumer facing domains like yahoo.com, aol.com, etc |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
65 // here, since such messages from humans might be sent via mailing lists |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
66 // that will break the dkim signature. But this works well for commonly |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
67 // forged bulk senders like ebay and paypal. |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
68 some.spammer require_signed some.spammer // reject if not signed |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
69 |
|
331
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
70 adp.com require_signed adp.com; |
|
334
a4f2fda72422
missing ==0 testing for from header, we were scanning all the non-from headers
Carl Byington <carl@five-ten-sg.com>
parents:
331
diff
changeset
|
71 amazon.com require_signed amazon.com; |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
72 billpay.bankofamerica.com require_signed billpay.bankofamerica.com; |
|
334
a4f2fda72422
missing ==0 testing for from header, we were scanning all the non-from headers
Carl Byington <carl@five-ten-sg.com>
parents:
331
diff
changeset
|
73 craigslist.org require_signed craigslist.org; |
|
a4f2fda72422
missing ==0 testing for from header, we were scanning all the non-from headers
Carl Byington <carl@five-ten-sg.com>
parents:
331
diff
changeset
|
74 dhl.com require_signed dhl.com; |
|
a4f2fda72422
missing ==0 testing for from header, we were scanning all the non-from headers
Carl Byington <carl@five-ten-sg.com>
parents:
331
diff
changeset
|
75 dropbox.com require_signed dropbox.com; |
|
a4f2fda72422
missing ==0 testing for from header, we were scanning all the non-from headers
Carl Byington <carl@five-ten-sg.com>
parents:
331
diff
changeset
|
76 dvd.com require_signed dvd.com |
|
331
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
77 e.statefarm.com require_signed e.statefarm.com; |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
78 ealerts.bankofamerica.com require_signed ealerts.bankofamerica.com; |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
79 ebay.com require_signed ebay.com; |
|
331
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
80 ecommail.walgreens.com require_signed ecommail.walgreens.com; |
|
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
81 email.travelzoo.com require_signed email.travelzoo.com; |
|
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
82 email.jetblue.com require_signed email.jetblue.com; |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
83 facebookmail.com require_signed facebookmail.com; |
|
331
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
84 fedex.com require_signed fedex.com; |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
85 healthcare.gov require_signed healthcare.gov; |
|
331
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
86 iheartmedia.com require_signed iheartmedia.onmicrosoft.com; |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
87 linkedin.com require_signed linkedin.com; |
|
331
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
88 monster.com require_signed monster.com; |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
89 paypal.com require_signed paypal.com; |
|
334
a4f2fda72422
missing ==0 testing for from header, we were scanning all the non-from headers
Carl Byington <carl@five-ten-sg.com>
parents:
331
diff
changeset
|
90 paychex.com require_signed paychex.com; |
|
331
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
91 r.groupon.com require_signed r.groupon.com; |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
92 service.capitalone.com require_signed capitalone.com; |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
93 support.facebook.com require_signed support.facebook.com; |
|
331
9800776436b9
allow dkim whitelisting to override uribl hosts in the mail body
Carl Byington <carl@five-ten-sg.com>
parents:
330
diff
changeset
|
94 twitter.com require_signed twitter.com; |
|
330
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
95 ups.com require_signed ups.com; |
|
b5b93a7e1e6d
ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
96 wellsfargo.com require_signed wellsfargo.com; |
|
322
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
97 }; |
| 94 | 98 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
|
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
99 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s"; |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
100 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
|
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
101 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s"; |
| 94 | 102 ignore { include "hosts-ignore.conf"; }; |
| 103 tld { include "tld.conf"; }; | |
| 119 | 104 html_tags { include "html-tags.conf"; }; |
| 94 | 105 html_limit off; |
| 106 host_limit soft 20; | |
| 178 | 107 spamassassin 5; |
| 108 require_match yes; | |
| 109 dcc_greylist yes; | |
| 110 dcc_bulk_threshold 20; | |
| 94 | 111 }; |
| 112 | |
|
298
4dd677e3b509
add linode.com to generic regex
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
113 generic "^li.*members.linode.com$|^dsl.static.*ttnet.net.tr$|(^|[x.-])(ppp|h|host)?([0-9]{1,3}[x.-](Red-|dynamic[x.-])?){4}" |
| 168 | 114 "your mail server %s seems to have a generic name"; |
| 115 | |
|
233
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
116 white_regex "=example.com=user@yourhostingaccount.com$"; |
|
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
117 |
| 94 | 118 env_to { |
|
100
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
119 # !! replace this with your domain names |
|
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
120 # child contexts are not allowed to specify recipient addresses outside these domains |
| 179 | 121 # if this is a backup-mx, you need to include here domains for which you relay to the primary mx |
| 174 | 122 include "/etc/mail/local-host-names"; |
| 94 | 123 }; |
| 124 | |
| 125 context whitelist { | |
| 126 content off {}; | |
| 127 env_to { | |
| 128 # dcc_to ok { include "/var/dcc/whitecommon"; }; | |
| 129 }; | |
| 130 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted | |
| 131 # so all mail TO these env_to addresses is accepted | |
| 132 }; | |
| 133 | |
| 134 context abuse { | |
| 135 dnsbl_list xbl; | |
| 136 content off {}; | |
| 174 | 137 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 94 | 138 env_to { |
| 139 abuse@ # no content filtering on abuse reports | |
| 140 postmaster@ # "" | |
| 141 }; | |
| 142 env_from unknown {}; # ignore all parent white/black listing | |
| 143 }; | |
| 144 | |
| 145 context minimal { | |
| 171 | 146 dnsbl_list sbl; |
| 178 | 147 content on { |
| 148 spamassassin 10; | |
| 149 dcc_bulk_threshold many; | |
| 150 }; | |
| 171 | 151 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 94 | 152 env_to { |
| 153 }; | |
| 154 }; | |
| 155 | |
| 156 context blacklist { | |
|
255
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
157 dnsbl_list ; |
|
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
158 dnswl_list ; |
| 94 | 159 env_to { |
| 160 # dcc_to many { include "/var/dcc/whitecommon"; }; | |
| 161 }; | |
| 162 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted | |
| 163 # so all mail TO these env_to addresses is rejected | |
| 164 }; | |
| 165 | |
| 166 env_from unknown { | |
| 167 abuse@ abuse; # replies to abuse reports use the abuse context | |
| 168 # dcc_from { include "/var/dcc/whitecommon"; }; | |
| 169 }; | |
| 153 | 170 |
|
167
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
165
diff
changeset
|
171 autowhite 90 "autowhite/my-auto-whitelist"; |
|
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
165
diff
changeset
|
172 # install should create /etc/dnsbl/autowhite writable by userid dnsbl |
| 94 | 173 }; |
| 174 |